v2.7.0 — Stability & Security Hardening

OctoOffice v2.7.0

Released: 2026-06-30
Type: Patch / maintenance release (security + stability + docs)

TL;DR

A stability-and-hardening cut. Closes the three Known Follow-ups that v2.6.0
deferred (#134, #135, #136), patches a ws memory-disclosure advisory, makes
database migrations transaction-safe, and refreshes the README with an animated
demo of the live office.

No breaking API changes. No migrations required.

Security

• ws → 8.20.1 — fixes an uninitialized-memory disclosure
  (GHSA-58qx-3vcg-4xpx) reachable through the WebSocket layer.
• Moderate prod-audit advisories cleared — pnpm audit --prod is clean again.
• gitleaks allowlist added so secret-scanning CI no longer trips on known
  test fixtures.
• private: true flag added to package.json to prevent accidental
  npm publish of the app package.

Fixes

• #134 / #138 — OAuth empty-string round-trip. encryptSecret("") now
  produces a payload that decrypts back to "", closing the v2.6.0 follow-up.
• #135 / #139 — IPv6 redirect validation. sanitizeOAuthRedirect now
  normalizes the bracketed [::1] form returned by URL.hostname, so loopback
  IPv6 redirects are accepted instead of rejected.
• #141 / #142 — Migration transactions. Migrations now manage their own
  transaction boundary, preventing partially-applied schema changes if a single
  migration fails midway.
• Mobile chat design aligned with the desktop composer; README logo fixed so
  it renders correctly in GitHub Mobile.

Housekeeping

• #136 / #140 — Coverage scope. Type-only and pack-hook files are excluded
  from backend coverage so reported statement coverage reflects real code.
• Dead code removed — unused dependencies, dead exports, and unreferenced
  internals pruned.
• CI on Node 24 action runtimes; sharp 0.35.x pinned out pending upstream.
• Dependency bumps — 19 + 12 + 18 minor/patch updates across three waves
  (incl. vite 7→8, undici 7→8, @vitejs/plugin-react 5→6), all green through CI.

Docs

• Animated office demo. The README hero is now a short GIF that opens on the
  full MissionControl dashboard and tours the pixel-art office, linked to a
  full-quality MP4. A custom social-preview (OG) image was added for shared links.
• Reusable capture tooling (scripts/capture-fullpage.mjs,
  scripts/capture-office-gif.mjs, scripts/render-tour.sh) for regenerating
  demo assets headlessly via Playwright + ffmpeg.

Upgrade Notes

No migrations required. After pulling:

pnpm install --frozen-lockfile
pnpm run setup

Existing OAuth tokens, settings rows, and pack positions continue to work without
re-encryption or schema changes.

v2.6.0 — Code-Review Backlog Cut

OctoOffice v2.6.0

Released: 2026-05-08
Type: Minor release (security + architecture + testing)

TL;DR

Closes the entire 2026-05-07 code-review backlog: 41/41 high-and-critical
issues across five waves, plus three transitive-dependency security overrides.
Backend test coverage expands from 35 % statements to 39 % statements / 72 %
functions / 72 % branches; backend test count grows from ~1900 to 2492.

No breaking API changes. Existing runtime contracts preserved.

Overview by Stream

Wave 1 — Critical security (4 issues)

Already shipped via hotfixes between v2.5.2 and this cut:

• Shell-injection prevention in GIT_ASKPASS (#51).
• Whole-string validation for CLI API keys (#53).
• safeCommunityPath containment for default_workspace (#88).
• /api/github/clone containment to home root (#54).

Wave 2 — Frontend & Accessibility (7 issues)

• #52 MobileBottomSheet exposes role="dialog", aria-modal, focus-trap, and Escape-to-close.
• #60 useMobile hook is SSR-safe and falls back to legacy addListener on older Safari.
• #61 Pixi.js office canvas honors prefers-reduced-motion for wandering, walk-cycle, head-bob, typing-jitter, and pulse animations.
• #62 Light theme --text-muted darkened to #52525b (≥7:1) and --accent-text to #047857 (≥5.25:1) to meet WCAG AA.
• #63 Topbar nav, ghost buttons, + NEW MISSION, and pack selector enlarged to ≥36×36 (WCAG 2.5.8).
• #64 Pixi office canvas exposes a visually-hidden DOM-twin department list revealed on :focus-within.
• #65 App.tsx extracted into RoomThemesContext, DecisionInboxContext, and useOfficePackBootstrap; handlers memoized with useCallback.

Wave 3 — Security & Architecture (8 issues)

• #89 SSRF guard pre-resolves DNS and pins the validated IP to a request-scoped undici.Agent dispatcher, closing the TOCTOU window. Reviewer-driven follow-up (#89 review #2): redirect loop re-validates every hop with a 5-hop limit and strips Authorization on cross-origin redirects.
• #90 pnpm.overrides pin ip-address >= 10.1.1 (GHSA-v2v4-37r5-5v8g, XSS in Address6).
• #91 pnpm.overrides pin hono >= 4.12.16 (GHSA-9vqf-7f2p-gf9v bodyLimit bypass + GHSA-69xw-7hcm-h432 JSX injection).
• #55 ComfyUI HTTP helpers moved into connectors/built-in/comfyui/http.ts; legacy modules/workflow/comfyui/* exports are @deprecated re-exports. New architecture test enforces one-way layering.
• #56 graph-builder.ts moved into server/packs/; orchestration now imports from packs/, breaking the mutual recursion. New architecture test enforces packs/ does not import from modules/workflow/.
• #57 Approve handler stops the active agent process before mutating phase state, mirroring /reset and /reset-from.
• #58 routeFollowUpViaCeo returns a discriminated RoutingResult ({decision, source} | {decision: null, reason}) with metrics emitted per branch (ceo.followup.routing).
• #59 Phase-approve re-run uses deps.runTask instead of an HTTP self-loop, removing dead SESSION_AUTH_TOKEN/port logic.

Wave 4 — TypeScript Strictness (10 issues)

• #78 Drop Promise<any> casts from src/api/messaging-runtime-oauth.ts; six functions now use typed post<T>() and resp.json() as Promise<T> matching their declared signatures.
• #79 CrossDeptCooperationDeps replaced with concrete Pick<RuntimeContext, …> interface (32 fields).
• #80 ReportRoutingDeps, ReviewConsensusDeps, and OutcomeContext replaced with concrete Pick<RuntimeContext, …> interfaces.
• #81 PUT /api/settings enforces a 32-key allowlist; unknown keys return 400 unknown_setting_key. GET /api/settings filters internal keys (access_password_hash, mcp_servers, remote_session:*, etc.) so they cannot leak via authenticated round-trip.
• #82 PUT /api/ops/workflow-packs/:key/positions validates the body with a strict Zod schema (≤200 phases, finite numbers, strictObject for {x, y}).
• #83 db: any replaced with structural DbLike across 13 deps interfaces. New shared server/types/db-like.ts.
• #84 useAgentLayer per-agent sprite-load failures isolated via Promise.all(agents.map(...)) and logged.
• #85 LLM API responses validated with per-provider Zod schemas (Anthropic, Google, OpenAI). Throws typed LlmResponseParseError on shape mismatch instead of silently returning empty strings.
• #86 CSRF guard res parameter typed as express.Response across execution-control, api-providers, operations, and mcp-servers.
• #87 cli-auth route handlers use catch (err: unknown) + toErrorMessage(err).

Wave 5 — Test Coverage (11 issues)

Module	Coverage gain
message-idempotency.ts	0 % → 99 % statements (#66)
oauth/encryption (encrypt/decrypt)	0 % → 100 % branch (#67)
decision-inbox-routes.ts	23.66 % → 96.79 % (#68)
opencode adapter	30.95 % → 100 % (#69)
context-sharing.ts	0 % → 100 % (#70)
planned-approval.ts	0 % → 100 % statements / 80.76 % branch (#71)
planning-archive-tools.ts	0 % → 100 % statements / 90.21 % branch (#72)
oauth/helpers (PKCE/redirect)	27.27 % func → 100 % branch (combined with #67, #73)
oauth-runtime.ts	0 % → 95.91 % (#74)
cli-runtime.ts (agent spawn path)	0 % → 86.92 % (#76)
ceo-orchestrator.ts (tick loop)	18.55 % → 97.30 % (#77)

Plus a Vitest regression suite that asserts every mergeSettingsWithDefaults({}) key is in ALLOWED_SETTING_KEYS, preventing future drift.

Bonus — fast-uri override

Surfaced during Wave 5 CI: pnpm audit flagged fast-uri <= 3.1.0 (GHSA-q3j6-qgpj-74h6, path traversal via percent-encoded dot segments) pulled transitively via @modelcontextprotocol/sdk > ajv. Pinned via pnpm.overrides to >= 3.1.1.

Reviewer Findings Resolved Mid-Stream

The release also incorporates reviewer-driven follow-up commits:

• PR #100 / #61 review: Reduced-motion gate extended to per-tick path-following so sprites freeze entirely (not just stop typing-jitter).
• PR #101 / #63 review: Nav tabs, + NEW MISSION, and pack selector all bumped from 32/28 px to ≥36 px so the title commitment matched the diff.
• PR #98 / #64 review: .sr-only-focusable utility introduced; the department panel becomes a visible, framed widget when any inner button has focus.
• PR #103 / #89 review #1 (TOCTOU): safeFetch() helper introduced with pinned-IP undici.Agent.
• PR #103 / #89 review #2 (redirects): Redirect loop re-validates every hop, hop limit 5, Authorization stripped on cross-origin.
• PR #110 / #59 review: Build break from required runTask dep fixed in test harnesses.
• PR #115 / #81 review: GET filter added so internal keys cannot round-trip back through PUT.
• PR #123 / #67 review: Encryption tests made .env-independent via vi.doMock("…/runtime.ts").
• PR #129 / #73 review: sanitizeOAuthRedirect rejects protocol-relative // redirects.

Known Follow-ups

Captured as low-priority issues for a later cycle:

• #134 encryptSecret("") produces a payload that cannot round-trip; current behavior is pinned by a regression test.
• #135 sanitizeOAuthRedirect rejects IPv6 [::1] redirects because URL.hostname returns the bracketed form; equality check should normalize.
• #136 Vitest scope includes type-only files (server/types/*) which suppress reported statement coverage; adding them to coverage.exclude is a one-line fix.

Numbers

Metric	v2.5.2	v2.6.0
Open code-review issues	41	0
Backend test count	~1900	2492 (+30 %)
Backend statement coverage	35.47 %	39.34 %
Backend branch coverage	not measured	71.78 %
Backend function coverage	not measured	72.97 %
Frontend test count	217	270 (+24 %)
pnpm audit --prod --audit-level=high	4 advisories	0 advisories

Upgrade Notes

No migrations required. After pulling:

pnpm install --frozen-lockfile
pnpm run setup

Existing OAuth tokens, settings rows, and pack positions continue to work without
re-encryption or schema changes.

v2.5.1 — Post-release hardening

Post-release hardening and polish on top of the v2.5.0 rebrand. No breaking changes.

Added

• Mobile agent picker in the Chat Panel — switch the active agent without leaving the conversation view.

Security

• Dependency security patches via pnpm overrides: @xmldom/xmldom >=0.8.13, hono >=4.12.14, @hono/node-server >=1.19.13, postcss >=8.5.10.
• Auth hardening, data validation, WebSocket safety, and API shape consistency (deep audit follow-up).
• Fixed CSRF token race condition on realtime-updates session restore.

Changed

• Reports now always produce a markdown deliverable; the design-checkpoint workflow and tools/ppt_team_agent submodule have been removed.
• templates/AGENTS-octooffice.md restored so pnpm setup works on a fresh clone.
• Personal identifiers in UI placeholders and test fixtures replaced with neutral RFC 5737 documentation values.
• Community health files and package.json metadata aligned.

Fixed

• pnpm build regression from dormant-code cleanup.
• Auth noise, New Pack dialog race condition, branches endpoint.
• E2E test suite: pack-selector contamination, department ID casing, settings language selector, SetupWizard overlay, WebSocket UI test flakiness.
• Mobile UI polish: header, bottom sheet, tab bar typography, Projects view, Mission Control tabs, Terminal panel header.

Upgrade

git pull
pnpm install
pnpm dev

No database migrations required.

v2.5.0

OctoOffice v2.5.0 Release Notes

• Release date: 2026-04-01
• Scope: Full rebrand from OctoOffice to OctoOffice with a new visual identity, redesigned office home layout (MissionControl), unified top-bar navigation, live task view panel, phase-selection UI in task creation, pack department restructure, graph editor UX improvements, and autonomous scheduler safety gating.

Highlights

1. OctoOffice Dashboard Rebrand

The application has been fully rebranded from OctoOffice to OctoOffice with a new visual identity applied across all surfaces.

• App name changed to OctoOffice (formerly OctoOffice v2.0.x).
• Dark mode palette: near-black base (#0d0d0f) + emerald accent (#34D399).
• Light mode palette: #fafafa base + darker emerald (#10B981).
• Typography: Press Start 2P for pixel-art headers; JetBrains Mono for body text and data readouts.
• New logo: public/assets/octooffice-logo.svg — a 64×64 pixel-art OctoOffice head.
• CSS custom properties (--bg-base, --accent, --border) are now the canonical colour tokens across all components.
• TerminalPanel restyled with OctoOffice palette (emerald accent, dark base) and fixed sliding under the top bar via --topbar-height CSS offset.
• Removed design mockup images and legacy OctoOffice branding assets.

2. MissionControl — 3-Column Office Home Layout

The Office tab now renders MissionControl (src/components/mission-control/MissionControl.tsx) instead of a fullscreen Pixi canvas, giving the home view a structured three-column layout:

• Left (270px): AgentSidebarPanel — scrollable agent cards with sprite avatars and token usage bars.
• Center (flex): Embedded RetroOfficeView Pixi.js canvas (expandable to fullscreen via "↗ Expand") stacked above MiniKanban (5-column compact board) and MetricsStrip (token donut + aggregate stats).
• Right (384px, collapsible): Full ChatPanel supporting all message modes — task, announcement, report, and directive.

3. OctoOfficeTopBar — Unified Navigation

RetroSidebar and RetroHeader have been replaced by a single 46px OctoOfficeTopBar that consolidates all primary navigation and controls:

• 7 tabs: Office, Tasks, Ops, Roster, Library, Projects, Settings.
• Theme toggle, clock, and action buttons consolidated in the top bar.
• Mobile layout preserves the hamburger sidebar and bottom navigation bar.
• Theme localStorage key is unchanged; no user settings are lost on upgrade.

4. LiveTaskView Panel

A new real-time agent activity panel (LiveTaskView) has been added to MissionControl as part of the right-column layout (#25):

• Agent activity timelines showing current phase and live status for each active task.
• Live CLI terminal output streamed via cli_output WebSocket events.
• Phase state overlays driven by subtask_update WebSocket events.
• Data flows through the existing useRealtimeSync hook → App.tsx → MissionControl → LiveTaskView — no new backend endpoints required.

5. Phase Selection UI in Task Creation

Task creation now allows selecting a specific starting phase when creating a pack-based task (#21):

• Pack phase list rendered as selectable steps inside the task creation dialog.
• Selecting a phase resets the pipeline state to that phase entry point.
• Authentication integration enforces phase-gated access rules at dialog time.
• Redundant inputs are removed automatically on phase selection change.

6. Pack Department Restructure

The pack-to-department mapping has been rebuilt so that department metadata is owned by the pack definition itself:

• Each pack's departments: YAML section is now the canonical source for department slugs and labels.
• Web research pack: removed the unused analysis department.
• Workflow editor improvements: better dropdown controls and node connectivity handling.

7. Graph Editor UX Overhaul

Multiple improvements to the Visual Node Editor (React Flow-based):

• Better node connectivity — drag-to-connect port interactions made more reliable.
• Improved phase node layout and label rendering at all zoom levels.
• Editor and Builder mode refinements for metadata editing and new-pack creation.
• YAML preview panel accuracy improvements.

8. Autonomous Scheduler Safety Gating

The autonomous CEO scheduler is now blocked from advancing tasks that have pipeline phases awaiting human approval:

• Tasks with any subtask in awaiting_approval state are skipped by the scheduler.
• Prevents runaway automation past approval gates in multi-phase pipelines.
• No change to manual task execution — only the autonomous scheduler is gated.

9. Fixes and Housekeeping

• Renamed seed agents to German names for consistency with German-locale deployments.
• Pipeline subtasks are now reset on hard failure to enable clean retry without manual intervention.
• Resolved build errors and workflow view layout issues (#23).
• Resolved security and UX issues surfaced during code review (#24).

API and Behavior Notes

• MissionControl replaces the fullscreen RetroOfficeView as the default render target for the Office tab; the fullscreen canvas is still accessible via the "↗ Expand" button in the center column.
• LiveTaskView data source: existing WebSocket events cli_output and subtask_update only — no new backend endpoints were added.
• Task creation: POST /api/core/tasks now accepts an optional startPhaseId parameter to pin the initial phase of a pack workflow.
• Pack department structure: the departments: section of pack.yaml is now the canonical source of department metadata; runtime department sync reads from there at hydration time.
• Connector and adapter surface unchanged from v2.0.x.

Compatibility Notes

• The OctoOffice colour palette replaces the prior OctoOffice / OctoOffice token set. Custom CSS overrides that reference old colour values will need to be updated to use the --bg-base, --accent, and --border CSS custom properties.
• OctoOfficeTopBar supersedes both RetroSidebar and RetroHeader. Code or E2E tests that target sidebar or header selectors will need to be updated to OctoOfficeTopBar.
• Theme localStorage key is unchanged — no user setting loss occurs on upgrade.
• The autonomous scheduler will now pause at approval gates. Tasks with awaiting_approval pipeline phases will not be auto-advanced; this is intentional safety behaviour and not a regression.